Recent submissions

Comment · 2 days ago
The only way I see to disincentivise first to publish is public shaming. Damaging the very reputation they are trying to inflate.

This blog post does well to remind or educate only for everyone else who's interests are actually aligned with public good.

Comment · 7 days ago
I was suspicious the absence of a severity filter was exaggerating the trend...

But then I found this:

https://craci.com/resources/CVE-publication-trends?sev=criti...

Trend for critical CVEs is actually worse, at roughly 25x that of 2020, compared to all CVEs which are roughly 5x compared to 2020.

Comment · 11 days ago
For claims of up to "2x" it certainly can do, but depending on the application and hardware, just like this.

It's not clear to me from the article if the comparison is with locally compiled binaries, that would be the fair comparison.

I would expect this to be better all rounder in theory, but it would be interesting to see what the difference is from a locally compiled baseline, and therefore if the complexity, obscurity and cost is worth it (again probably application and hardware dependant question).

Comment · 25 days ago
This looks very similar to the Doom fire algorithm (later), except that one is applied to a fixed buffer over and over again every frame.

> it is tempting to view the algorithm as based on cellular automata (Sarkar 2000), yet the lack of parallelism and the strange shape of the 'neighbourhood' of cells surrounding X makes the cellular-automata notion contrived.

If you consider rows as time then dependence is local rather than global. It looks like a 2D automata with a temporal neighbourhood component. And IMO asymmetric or nonuniform neighbourhoods dont necessarily exlude it from the definition, but affects its classification.

Does anyone with deeper academic overview of CA have any insight here? I find many things can look like CA if you stare at it right, but am never sure where to draw the line (maybe there isnt one)

Comment · 29 days ago
I wish I could upvote this more. The reality is dwarfed by a mega thread commenting on noise.
Comment · 1 month ago
> I’m a big fan of Hanlon’s razor.

There is a 3rd option: malicious stupidity / aka wilful ignorance.

Google is a collection of individuals, so it's very likely both sides of Hanlon's razor are true: a little malice from those in control, persisting a state of stupidity for those executing the process.

As others have pointed out, there will be resistance to improving a process that negatively impacts their bottom line. Incentives, dictate long term behaviour of organisations; whereas Hanlon's razor works better at an individual level IME.

Comment · 1 month ago
I'm not completely sure if this is supposed to be sincere, but it should be.

It's not uncommon practice to omit the security implications on public facing commit messages when fixing secirity issues, so as to not to draw attention until it's ready for distribution.

Comment · 1 month ago
Yes, that used to be the way. But it's getting increasingly hard to ignore their smart functionality and be comfortable enough simply leaving it "unnetworked".

The problem is the incentives, even though TVs represent a higher turnover for LGE (roughly $1 B), they barely break even, whereas most of the 0.5 B from their advertising division (made through the TVs) is majority profit. They don't want you to use their TVs as monitors (they lose money that way), they are highly incentivised to find a way to track you. This is not unique to LG but they seem the worse affected while having the largest chunk of the market.

I feel a lot more comfortable with a monitor controller attached to the same OLED panel rather than trying to figure out if i've neutered LGs ad department enough, or worrying about it somehow independently gaining network in the future after monitoring everything in isolation as proven in this latest news. I think LG tvs doing something like automatic exfil via their own mesh network in future is not far fetched, it's practical with their market share and they have the incentives.

Comment · 1 month ago
Comment · 1 month ago
Yes, the irony is that vertically scaling will always go "faster" due to latency until you genuinely need more DB than a single box can handle. Premature horizontal scaling only increase complexity and reduce performance. And even when you genuinely need it the implementation has to fight merely to approach single box latency, which sounds like what these guys have done.

But also vertical scaling seems to be able to handle so much these days that more people probably aught to ask themselves if their application is ever likely to truly need horizontal scaling - Maybe my work is just a small pond, but I suspect we will eventually end up in a place where the vast majority of applications are happy on a single box, and only twitter scale things need to care about this stuff.

.. or maybe I lack imagination of what possible future applications might make use of such massive horizontal scaling on such capable individual boxes (seriously).

Comment · 1 month ago
Thats a good point to highlight.

If the purpose of down votes is to guide discussion away from uninteresting or counterproductive paths, then it also scoops up divisive comments.

I suppose divisive comments are potentially disruptive if they are particularly flamey. But it seems like they deserve to be distinguished from more objectively negative comments. If the raw up/downs were exposed it would be interesting to experiment with this in the front end.

Comment · 2 months ago
Exactly. Framing completely changes this from an absurd story causing pointless grounding due to loss of institutional knowledge, to an example of good judgement (or protocol) in the absence of knowledge and acknowledgement of the risk of unknown consequences.

What's being ignored is the 1/100 of these stories where this judgement pays off, saves aircraft and lives that make the other 99 worth while.

Comment · 2 months ago
I think this is best described as a one-shot control plane, the single use address/key (same thing) is shared out of band, so it's far more minimal than the TS control plane.

The examples show the concrete use cases... Basically giving you the wiregaurd + DERP quality tunnel but as a one shot point to point cli tool. Which is a nice upgrade from the alternative "in a pinch" tools.

RE "how much tailscale" I guess it's the DERP bit + this minimal point to point control plane. Without which it's significantly more configuration to get the wiregaurd tunnel working, or impossible because of NAT, unless both machines are on the same ipv6 network.

TS basically sell the full control plane with Auth and ACL style management etc as their product so this doesn't really compete.

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton